Independent comparison of vendors building AI for shippers, third-party logistics operators, freight brokers and last-mile platforms in 2026. Logistics AI is not high-risk by default under EU AI Act Annex III, but workloads touching worker management (Annex III point 4) or critical-infrastructure operations (Annex III point 2) can be in scope, and NIS2 and the Cyber Resilience Act now bind connected systems [1][2].
Vendors were selected on five criteria: depth of EU AI Act practice (specifically the trigger conditions where logistics workloads cross into Annex III point 2 critical infrastructure or point 4 worker management, classifying the workload as high-risk), logistics-vertical specialisation evidenced by named shipper, 3PL or freight-broker deployments, a written delivery methodology, multilingual delivery across at least three European languages, and a citation chain in shipped outputs (load-level or shipment-level traceability for routing, allocation and pricing decisions).
The list is ordered by shape of fit, not ranked. The middle of the list is not worse than the top.
Honesty disclosure: Impetora is one of the nine vendors below. We have written our own entry in the same factual register as the others. We do not invent statistics and we do not trash competitors.
Verification: every vendor below was confirmed operating as of April 2026 by checking their public website and a recent press mention. Slync was excluded after entering Chapter 11 proceedings in 2023; we treat the brand as uncertain pending the asset disposition.
Five practical tests separate logistics-credible vendors from generalists with a supply-chain slide deck. First, can the vendor produce a written EU AI Act classification rationale showing whether the specific workload crosses into Annex III point 2 (critical infrastructure including supply of water, gas, heat, electricity, and digital infrastructure) or point 4 (employment, workers management and access to self-employment, including driver allocation, performance evaluation and termination) [1]? Second, has the vendor read NIS2 (Directive (EU) 2022/2555) on cybersecurity risk management for essential and important entities, and can they articulate how delivery satisfies the supply-chain-security obligations [2]? Third, do shipped outputs include load-level or shipment-level evidence chains traceable to source data and policy? Fourth, can the vendor demonstrate Cyber Resilience Act (Regulation (EU) 2024/2847) readiness for any connected component shipped into the EU after 11 December 2027? Fifth, does the proposal name the senior engineer who will be hands-on?
Vendors that cannot articulate the high-risk trigger conditions and the NIS2 supply-chain duties should not progress.
The EU AI Act, Regulation (EU) 2024/1689, does not put logistics workloads in the high-risk tier by default. Annex III point 2 catches AI used as a safety component in management and operation of critical infrastructure, which can pull rail-traffic management, port operations and energy-supplied logistics in scope. Annex III point 4 catches AI used in employment and worker management, which can pull driver allocation, performance scoring and termination decisions in scope [1]. Annex III point 7 catches AI used by competent authorities for migration and border control, which is not a private logistics workload but adjacent. The vendor proposal should include a written classification rationale.
NIS2, Directive (EU) 2022/2555, applies from 18 October 2024 to a broad set of essential and important entities including transport sub-sectors. The directive imposes 10 baseline cybersecurity-risk-management measures including supply-chain security, incident reporting within 24 hours and management-body accountability [2]. AI vendors are now part of the supply-chain-security perimeter; carrier and broker procurement teams should expect to see vendor cybersecurity controls evidenced.
The Cyber Resilience Act, Regulation (EU) 2024/2847, applies from 11 December 2027 to products with digital elements placed on the EU market. AI components shipped inside connected logistics products (telematics, smart-trailer firmware, port-equipment software) will fall under CRA conformity. GDPR Article 22 applies separately to solely-automated decisions affecting drivers and other natural persons.
Buy when: the workload is generic last-mile dispatch on a standard urban delivery pattern, and a productised platform such as Locus.sh or a TMS-embedded optimiser already covers 80% of the use case.
Build when: the workload is specific to your network (cross-border road-freight Europe, multilingual carrier-document extraction across 20+ languages, a particular customs regime), where confidentiality requires a sub-processor footprint a SaaS vendor cannot offer, where worker-management AI must avoid Annex III point 4 high-risk trigger conditions, or where NIS2 supply-chain evidence must be owned by the buyer.
Hybrid when: route optimisation is bought from a productised platform but customs-document classification, multilingual driver Q&A and exception-handling are custom because the network is bespoke. Most enterprise logistics AI in 2026 ends up here.
Send the same five written questions to every vendor on the shortlist:
Vendors that send marketing PDFs in response are not ready. Vendors that respond with a redacted classification rationale and a NIS2-aligned supply-chain-security pack are.
Ready to scope your project? Submit a short brief and we reply within one business day.
Tell us what you would like to build. We reply within one business day.